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REMARKS 

Reconsideration and allowance of the subject application in view of the foregoing 
amendments and the following remarks is respectfully requested. 

Claims 1-43 are pending. 

Claim 1 has been amended to conform to commonly accepted US Patent practice. New 
claims 42-43 have been added to secure an appropriate scope of protection to which applicants are 
believed entitled. Support for the subject matter of new claim 42 is believed to be found at at least 
page 10, lines 12-16. Support for the subject matter of new claim 43 is believed to be found at at 
least page 9, line 1 through page 14, line 29. Claims 16 and 28 have been amended to correct an 
antecedent basis issue. 

Claims 1-6. 8. 9. 14-18. 20. 21. 23. 29-34. and 41 are patentable over Shipp (GB 2 367 714) in 
view of Andersen (US 6.122.740) 

The rejection of claims 1-6, 8, 9, 14-18, 20, 21, 23, 29-34, and 41 under 35 USC 103(a) over 
Shipp in view of Andersen is hereby traversed. There are at least five reasons claim 1 is patentable 
over the combination of references and withdrawal of the rejection is respectfully requested. 

Shipp fails to disclose "storing in a buffer data relating to requests which identify a 
destination host not in the record" as claimed in claim 1. The PTO-identified portion of Shipp, 
reproduced herein for ease of reference, states: 

Holding them in temporary storage and notifying the addressee by email that an 
infected message has been intercepted and is being held for a period for their 
retrieval, should they wish, otherwise it will be deleted. 

Shipp at page 12, lines 3-5. 
First, the PTO-identified portion of Shipp appears to describe holding emails in temporary 
storage without identifying that the emails identify a destination host not in a record. Shipp appears 
to describe holding an intercepted, infected message and notifying the addressee of the held 
message. Shipp fails to identify that the intercepted, infected message identifies a destination host 
not in a record. For at least this reason, withdrawal of the rejection is respectfully requested. 
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Further, none of the "criteria by which emails may be assessed" to identify email viruses 
include requests identifying a destination host not in the record. Shipp at page 5, line 28, see also 
the criteria at pages 5, line 25 through page 6, line 7. For at least this reason, withdrawal of the 
rejection is respectfully requested. 

Second, Shipp fails to disclose a record as claimed in claim 1 within which requests 
identifying a destination host are not found. Shipp does not appear to describe a record indicative of 
identities of hosts within the network to whom data has been sent. The PTO admits that Shipp fails 
to disclose establishing a record as claimed in claim 1. Without disclosure of such a record, 
Applicants fail to understand how Shipp can be asserted to disclose storing requests which identify 
destination hosts not in the record. For at least this reason, withdrawal of the rejection is 
respectfully requested. 

The PTO admits that Shipp fails to disclose establishing a record, comparing, and 
transmitting all requests as claimed in claim 1. 

Andersen fails to disclose "comparing (a) identities of destination hosts identified in requests 
to send data from the first host and (b) identities of destination hosts identified in the record" as 
claimed in claim 1. The PTO-identified portion of Andersen, reproduced herein for ease of 
reference, states: 

The logging DLL then receives a request to access a host system, step 410, 
compares the host system to the locally stored access list, step 415, and checks 
whether the request conflicts with the access list, step 420. 

Andersen at column 6, lines 56-59. 

First, the PTO-identified portion of Andersen appears to describe a different element of the 

Andersen remote access logging system from the element described at column 5, lines 19-23. That 

is, the access list referred to at column 6, lines 56-59 does not appear to be the same as the log data 

referred to at column 5, lines 19-23. Further, Andersen appears to describe the access list as "a list 

of network identifiers which are not to be accessed by the user of the system" or "a list of words or 

phrases." Andersen at column 6, lines 31-36. Andersen fails to disclose that the access list is the 

log data or vice versa. Thus, Andersen fails to disclose the comparing as claimed in claim 1 . For at 

least this reason, withdrawal of the rejection is respectfully requested. 
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A prima facie case of obviousness has not been set forth with respect to Shipp and Andersen 

The PTO asserts that a person of ordinary skill in the art at the time of the present invention 
would be motivated to combine Andersen with Shipp in order to identify patterns characteristic of a 
virus outbreak and take corrective action. 

First, Applicants fail to understand the combination asserted by the PTO. That is, the PTO 
appears to be asserting, without any basis in either reference, the combination of an in-bound email 
filter mechanism as described in Shipp with an out-bound network access logging mechanism as 
described in Andersen. The mechanisms of Shipp and Andersen appear to be directed to different 
problem areas and were not likely to have been combined by persons of ordinary skill in the art. 
For at least this reason, withdrawal of the rejection is respectfully requested. 

Second, combining Andersen with Shipp in the manner asserted by the PTO would appear to 
change the operation of the Shipp reference. That is, Shipp, upon detection of email traffic 
characteristic of a virus, performs one of three modifying operations on an infected email, as 
described at page 12, lines 1-9, i.e., disposing, holding, and disinfecting. None of the operations 
includes transmitting the request. Combining Andersen with Shipp would appear to enable the 
transmission of a message determined to be infected which would appear to conflict directly with 
the stopping action of Shipp. Thus, Andersen and Shipp are not believed to be combinable contrary 
to the PTO assertion thereof. For at least this reason, withdrawal of the rejection is respectfully 
requested. 

In the alternative, even assuming arguendo the asserted combination of Andersen with 
Shipp, claim 1 remains patentable over the references because the combination would appear to add 
an out-bound logging mechanism to a system comprising an in-bound email filter mechanism 
without disclosing "storing in a buffer data relating to requests which identify a destination host not 
in the record" where the "record is at least indicative of identifies of hosts within the network to 
whom data has been sent by a first host." For at least this additional reason, withdrawal of the 
rejection is respectfully requested. 

Based on at least each of the foregoing reasons, claim 1 is patentable over Shipp, singly or in 
combination with Andersen, and the rejection is respectfully requested to be withdrawn. 
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Claims 2-6, 8, 9, 14-18, 20, 21, and 23 depend, inter alia, from claim 1, include further 
features, and are patentable over the asserted combination of references for at least the reasons 
advanced above with respect to claim 1 . Withdrawal of the rejection is respectfully requested. 

Claim 29 is patentable over the asserted combination of Andersen in view of Shipp for at 
least reasons similar to those advanced above with respect to claim 1 and the rejection is 
respectfully requested to be withdrawn. 

Claims 30-34 and 41 depend, inter alia, from claim 29, include further features, and are 
patentable over the asserted combination of references for at least the reasons advanced above with 
respect to claim 29. Withdrawal of the rejection is respectfully requested. 

The rejection of claims 7, 10-13, 19, 22, and 35-40 under 35 USC 103(a) as being 
unpatentable over Shipp in view of Andersen and variously, Maker, III et al. (US 7,058,974), 
Ramanujan (US 5,341,491), Cunningham et al (EP 0 986 229), and Anderson (US 2002/0013858) 
are hereby traversed. None of Maher, Ramanujan, Cunningham, or Anderson appear to cure the 
above-noted deficiencies of the combination of Andersen and Shipp. For at least this reason, 
withdrawal of the rejection is respectfully requested. 

Claim 43 recites a method of monitoring propagation of viruses within a network of hosts 
comprising establishing a record which is at least indicative of identities of destination hosts within 
the network to whom data has been sent by a first host; during a first time interval, comparing (a) 
identities of destination hosts identified in requests to send data from the first host and (b) identities 
of destination hosts identified in the record; transmitting all requests to send data; and storing in a 
buffer data to identify as such those requests which identify a destination host not in the record 
which is not disclosed or suggest by the applied references, singly or in combination. 
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Conclusion 



All objections and rejections having been addressed, it is respectfully submitted that the 
present application should be in condition for allowance and a Notice to that effect is earnestly 



To the extent necessary, a petition for an extension of time under 37 C.F.R. 1.136 is hereby 
made. Please charge any shortage in fees due in connection with the filing of this paper, including 
extension of time fees, to Deposit Account 08-2025 and please credit any excess fees to such 
deposit account. 
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